Security

Caching All Static Content in the Splunk UI

ngift
Engager

In troubleshooting an unrelated problem with Firebug, I took a look at the amount of http calls to static content, and it seems fairly significant. What are the recommended approaches supported by Splunk to cache content?

When I have done Plone development in the past I have used Varnish [1] and that had a dramatic impact on a heavy UI. I am curious what caching system splunk customers use. We are currently using ngnix, so perhaps enabling their caching might be a good choice [2].

  1. http://en.wikipedia.org/wiki/Varnish_(software)
  2. http://wiki.nginx.org/NginxHttpProxyModule#proxy_cache_path
Tags (4)

Simon
Contributor

Another way would to cache only static objects matching a pattern, for example with varnish in vcl_recv:

if (req.request == "GET" && req.url ~ ".(gif|jpg|swf|css|js|png|jpg|jpeg|gif|png|tiff|tif|svg|swf|ico|css|js|vsd|doc|ppt|pps|xls|mp3|mp4|m4a|ogg|mov|avi|wmv|sxw|zip|gz|bz2|tgz|tar|rar|)$" ) {
return(lookup);
}

HTH.

Simon

0 Karma

ziegfried
Influencer

I've used Apache httpd in front of Splunk with mod_cache and mod_rewrite/mod_expires to cache static content both on the client side (Expires header) and on the reverse proxy (in-memory cache). This brought a noticeable performance gain in some cases. This is possible with nginx as well. If you need to optimize the UI performance, you could cache all URIs that start with either /<locale>/static or /<locale>/modules.

eg. /en-US/static/* and /en-US/modules/*

The only thing that you might be aware of is that some custom modules from splunkbase are generating static content on-the-fly. This generated content should not be cached and those modules might not work correctly with such a configuration.

As an example, the nginx configuration could look like this (not tested):

    location ~ ^/[a-z]+\-[A-Z]+/(static|modules)/.* {
        proxy_pass             http://127.0.0.1:8000;
        proxy_set_header       Host $host;
        proxy_cache            STATIC;
        proxy_cache_valid      200  1d;
        proxy_cache_use_stale  error timeout invalid_header updating
                               http_500 http_502 http_503 http_504;
        expires 24h;
    }
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...